This is a locking problem. Something else (or the same thing in parallel) is calling session_start and not closing the session quickly.

It was becoming a big issue for me. Temporarily, I changed the code so that a Hybridauth session doesn't initialize except when Hybridauth itself is initialized... instead of doing it in the startup hook on each and every page load.

That seemed to do the trick at least so I can get through testing without a bunch of timeouts, but I'm assuming we can't leave it like that? I looked everywhere on Hybridauth's docs and found nothing mentioning use of sessions, so do we really need that?

Hybridauth uses sessions to track oAuth/etc key exchanges through hops. So, yes, it's needed, unless we replaced with a DB backend.
Your fix sounds correct.

Marking as resolved... the temporary fix is working well. Will keep as permanent.